39 files changed, 259 insertions, 194 deletions
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index 2028866f599..0676c6d8438 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -40,7 +40,6 @@
 *
 */
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/hardirq.h>
@@ -252,7 +251,7 @@ static inline void ath5k_txbuf_free(struct ath5k_softc *sc,
                return;
        pci_unmap_single(sc->pdev, bf->skbaddr, bf->skb->len,
                        PCI_DMA_TODEVICE);
-        dev_kfree_skb(bf->skb);
+        dev_kfree_skb_any(bf->skb);
        bf->skb = NULL;
 }
@@ -467,6 +466,7 @@ ath5k_pci_probe(struct pci_dev *pdev,
        mutex_init(&sc->lock);
        spin_lock_init(&sc->rxbuflock);
        spin_lock_init(&sc->txbuflock);
+        spin_lock_init(&sc->block);
        /* Set private data */
        pci_set_drvdata(pdev, hw);
@@ -587,7 +587,6 @@ ath5k_pci_suspend(struct pci_dev *pdev, pm_message_t state)
        ath5k_stop_hw(sc);
        free_irq(pdev->irq, sc);
-        pci_disable_msi(pdev);
        pci_save_state(pdev);
        pci_disable_device(pdev);
        pci_set_power_state(pdev, PCI_D3hot);
@@ -616,12 +615,10 @@ ath5k_pci_resume(struct pci_dev *pdev)
         */
        pci_write_config_byte(pdev, 0x41, 0);
-        pci_enable_msi(pdev);
        err = request_irq(pdev->irq, ath5k_intr, IRQF_SHARED, "ath", sc);
        if (err) {
                ATH5K_ERR(sc, "request_irq failed\n");
-                goto err_msi;
+                goto err_no_irq;
        }
        err = ath5k_init(sc);
@@ -642,8 +639,7 @@ ath5k_pci_resume(struct pci_dev *pdev)
        return 0;
 err_irq:
        free_irq(pdev->irq, sc);
-err_msi:
+err_no_irq:
-        pci_disable_msi(pdev);
        pci_disable_device(pdev);
        return err;
 }
@@ -2184,8 +2180,11 @@ ath5k_beacon_config(struct ath5k_softc *sc)
                sc->imask |= AR5K_INT_SWBA;
-                if (ath5k_hw_hasveol(ah))
+                if (ath5k_hw_hasveol(ah)) {
+                        spin_lock(&sc->block);
                        ath5k_beacon_send(sc);
+                        spin_unlock(&sc->block);
+                }
        }
        /* TODO else AP */
@@ -2408,7 +2407,9 @@ ath5k_intr(int irq, void *dev_id)
                                                  TSF_TO_TU(tsf),
                                                  (unsigned long long) tsf);
                                } else {
+                                        spin_lock(&sc->block);
                                        ath5k_beacon_send(sc);
+                                        spin_unlock(&sc->block);
                                }
                        }
                        if (status & AR5K_INT_RXEOL) {
@@ -2750,6 +2751,11 @@ static int ath5k_add_interface(struct ieee80211_hw *hw,
                ret = -EOPNOTSUPP;
                goto end;
        }
+        /* Set to a reasonable value. Note that this will
+         * be set to mac80211's value at ath5k_config(). */
+        sc->bintval = 1000;
        ret = 0;
 end:
        mutex_unlock(&sc->lock);
@@ -2794,9 +2800,6 @@ ath5k_config_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
        struct ath5k_hw *ah = sc->ah;
        int ret;
-        /* Set to a reasonable value. Note that this will
-         * be set to mac80211's value at ath5k_config(). */
-        sc->bintval = 1000;
        mutex_lock(&sc->lock);
        if (sc->vif != vif) {
                ret = -EIO;
@@ -3055,6 +3058,7 @@ static int
 ath5k_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
        struct ath5k_softc *sc = hw->priv;
+        unsigned long flags;
        int ret;
        ath5k_debug_dump_skb(sc, skb, "BC  ", 1);
@@ -3064,12 +3068,14 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
                goto end;
        }
+        spin_lock_irqsave(&sc->block, flags);
        ath5k_txbuf_free(sc, sc->bbuf);
        sc->bbuf->skb = skb;
        ret = ath5k_beacon_setup(sc, sc->bbuf);
        if (ret)
                sc->bbuf->skb = NULL;
-        else {
+        spin_unlock_irqrestore(&sc->block, flags);
+        if (!ret) {
                ath5k_beacon_config(sc);
                mmiowb();
        }
diff --git a/drivers/net/wireless/ath5k/base.h b/drivers/net/wireless/ath5k/base.h
index d7e03e6b827..7ec2f377d5c 100644
--- a/drivers/net/wireless/ath5k/base.h
+++ b/drivers/net/wireless/ath5k/base.h
@@ -172,6 +172,7 @@ struct ath5k_softc {
        struct tasklet_struct   txtq;           /* tx intr tasklet */
        struct ath5k_led        tx_led;         /* tx led */
+        spinlock_t              block;          /* protects beacon */
        struct ath5k_buf        *bbuf;          /* beacon buffer */
        unsigned int            bhalq,          /* SW q for outgoing beacons */
                                bmisscount,     /* missed beacon transmits */
diff --git a/drivers/net/wireless/ath9k/hw.c b/drivers/net/wireless/ath9k/hw.c
index bde162f128a..6dbfed0b414 100644
--- a/drivers/net/wireless/ath9k/hw.c
+++ b/drivers/net/wireless/ath9k/hw.c
@@ -5017,7 +5017,11 @@ static void ath9k_hw_spur_mitigate(struct ath_hal *ah,
        for (i = 0; i < 123; i++) {
                if ((cur_vit_mask > lower) && (cur_vit_mask < upper)) {
-                        if ((abs(cur_vit_mask - bin)) < 75)
+                        /* workaround for gcc bug #37014 */
+                        volatile int tmp = abs(cur_vit_mask - bin);
+                        if (tmp < 75)
                                mask_amt = 1;
                        else
                                mask_amt = 0;
@@ -7281,15 +7285,15 @@ ath9k_hw_set_keycache_entry(struct ath_hal *ah, u16 entry,
                }
                break;
        case ATH9K_CIPHER_WEP:
-                if (k->kv_len < 40 / NBBY) {
+                if (k->kv_len < LEN_WEP40) {
                        DPRINTF(ah->ah_sc, ATH_DBG_KEYCACHE,
                                 "%s: WEP key length %u too small\n",
                                 __func__, k->kv_len);
                        return false;
                }
-                if (k->kv_len <= 40 / NBBY)
+                if (k->kv_len <= LEN_WEP40)
                        keyType = AR_KEYTABLE_TYPE_40;
-                else if (k->kv_len <= 104 / NBBY)
+                else if (k->kv_len <= LEN_WEP104)
                        keyType = AR_KEYTABLE_TYPE_104;
                else
                        keyType = AR_KEYTABLE_TYPE_128;
@@ -7309,7 +7313,7 @@ ath9k_hw_set_keycache_entry(struct ath_hal *ah, u16 entry,
        key2 = get_unaligned_le32(k->kv_val + 6) ^ xorMask;
        key3 = (get_unaligned_le16(k->kv_val + 10) ^ xorMask) & 0xffff;
        key4 = get_unaligned_le32(k->kv_val + 12) ^ xorMask;
-        if (k->kv_len <= 104 / NBBY)
+        if (k->kv_len <= LEN_WEP104)
                key4 &= 0xff;
        if (keyType == AR_KEYTABLE_TYPE_TKIP && ATH9K_IS_MIC_ENABLED(ah)) {
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 2888778040e..c5107f269f2 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -206,7 +206,8 @@ static int ath_key_config(struct ath_softc *sc,
        if (!ret)
                return -EIO;
-        sc->sc_keytype = hk.kv_type;
+        if (mac)
+                sc->sc_keytype = hk.kv_type;
        return 0;
 }
@@ -756,7 +757,8 @@ static int ath9k_set_key(struct ieee80211_hw *hw,
                        key->hw_key_idx = key->keyidx;
                        /* push IV and Michael MIC generation to stack */
                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
-                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
+                        if (key->alg == ALG_TKIP)
+                                key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
                }
                break;
        case DISABLE_KEY:
@@ -1065,8 +1067,16 @@ void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                tx_info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
                tx_status->flags &= ~ATH_TX_BAR;
        }
-        if (tx_status->flags)
-                tx_info->status.excessive_retries = 1;
+        if (tx_status->flags & (ATH_TX_ERROR | ATH_TX_XRETRY)) {
+                if (!(tx_info->flags & IEEE80211_TX_CTL_NO_ACK)) {
+                        /* Frame was not ACKed, but an ACK was expected */
+                        tx_info->status.excessive_retries = 1;
+                }
+        } else {
+                /* Frame was ACKed */
+                tx_info->flags |= IEEE80211_TX_STAT_ACK;
+        }
        tx_info->status.retry_count = tx_status->retries;
diff --git a/drivers/net/wireless/ath9k/recv.c b/drivers/net/wireless/ath9k/recv.c
index 2fe806175c0..20ddb7acdb9 100644
--- a/drivers/net/wireless/ath9k/recv.c
+++ b/drivers/net/wireless/ath9k/recv.c
@@ -360,8 +360,9 @@ static void ath_rx_flush_tid(struct ath_softc *sc,
        struct ath_arx_tid *rxtid, int drop)
 {
        struct ath_rxbuf *rxbuf;
+        unsigned long flag;
-        spin_lock_bh(&rxtid->tidlock);
+        spin_lock_irqsave(&rxtid->tidlock, flag);
        while (rxtid->baw_head != rxtid->baw_tail) {
                rxbuf = rxtid->rxbuf + rxtid->baw_head;
                if (!rxbuf->rx_wbuf) {
@@ -382,7 +383,7 @@ static void ath_rx_flush_tid(struct ath_softc *sc,
                INCR(rxtid->baw_head, ATH_TID_MAX_BUFS);
                INCR(rxtid->seq_next, IEEE80211_SEQ_MAX);
        }
-        spin_unlock_bh(&rxtid->tidlock);
+        spin_unlock_irqrestore(&rxtid->tidlock, flag);
 }
 static struct sk_buff *ath_rxbuf_alloc(struct ath_softc *sc,
diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
index 157f830ee6b..550129f717e 100644
--- a/drivers/net/wireless/ath9k/xmit.c
+++ b/drivers/net/wireless/ath9k/xmit.c
@@ -357,9 +357,9 @@ static int ath_tx_prepare(struct ath_softc *sc,
        txctl->flags = ATH9K_TXDESC_CLRDMASK;    /* needed for crypto errors */
        if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
-                tx_info->flags |= ATH9K_TXDESC_NOACK;
+                txctl->flags |= ATH9K_TXDESC_NOACK;
        if (tx_info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
-                tx_info->flags |= ATH9K_TXDESC_RTSENA;
+                txctl->flags |= ATH9K_TXDESC_RTSENA;
        /*
         * Setup for rate calculations.
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index bd35bb0a148..bd65c485098 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -1304,7 +1304,7 @@ EXPORT_SYMBOL(atmel_open);
 int atmel_open(struct net_device *dev)
 {
        struct atmel_private *priv = netdev_priv(dev);
-        int i, channel;
+        int i, channel, err;
        /* any scheduled timer is no longer needed and might screw things up.. */
        del_timer_sync(&priv->management_timer);
@@ -1328,8 +1328,9 @@ int atmel_open(struct net_device *dev)
        priv->site_survey_state = SITE_SURVEY_IDLE;
        priv->station_is_associated = 0;
-        if (!reset_atmel_card(dev))
+        err = reset_atmel_card(dev);
-                return -EAGAIN;
+        if (err)
+                return err;
        if (priv->config_reg_domain) {
                priv->reg_domain = priv->config_reg_domain;
@@ -3061,12 +3062,20 @@ static void authenticate(struct atmel_private *priv, u16 frame_len)
        }
        if (status == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
-                /* Do opensystem first, then try sharedkey */
+                /* Flip back and forth between WEP auth modes until the max
+                 * authentication tries has been exceeded.
+                 */
                if (system == WLAN_AUTH_OPEN) {
                        priv->CurrentAuthentTransactionSeqNum = 0x001;
                        priv->exclude_unencrypted = 1;
                        send_authentication_request(priv, WLAN_AUTH_SHARED_KEY, NULL, 0);
                        return;
+                } else if (   system == WLAN_AUTH_SHARED_KEY
+                           && priv->wep_is_on) {
+                        priv->CurrentAuthentTransactionSeqNum = 0x001;
+                        priv->exclude_unencrypted = 0;
+                        send_authentication_request(priv, WLAN_AUTH_OPEN, NULL, 0);
+                        return;
                } else if (priv->connect_to_any_BSS) {
                        int bss_index;
@@ -3580,12 +3589,12 @@ static int atmel_wakeup_firmware(struct atmel_private *priv)
        if (i == 0) {
                printk(KERN_ALERT "%s: MAC failed to boot.\n", priv->dev->name);
-                return 0;
+                return -EIO;
        }
        if ((priv->host_info_base = atmel_read16(priv->dev, MR2)) == 0xffff) {
                printk(KERN_ALERT "%s: card missing.\n", priv->dev->name);
-                return 0;
+                return -ENODEV;
        }
        /* now check for completion of MAC initialization through
@@ -3609,19 +3618,19 @@ static int atmel_wakeup_firmware(struct atmel_private *priv)
        if (i == 0) {
                printk(KERN_ALERT "%s: MAC failed to initialise.\n",
                                priv->dev->name);
-                return 0;
+                return -EIO;
        }
        /* Check for MAC_INIT_OK only on the register that the MAC_INIT_OK was set */
        if ((mr3 & MAC_INIT_COMPLETE) &&
            !(atmel_read16(priv->dev, MR3) & MAC_INIT_OK)) {
                printk(KERN_ALERT "%s: MAC failed MR3 self-test.\n", priv->dev->name);
-                return 0;
+                return -EIO;
        }
        if ((mr1 & MAC_INIT_COMPLETE) &&
            !(atmel_read16(priv->dev, MR1) & MAC_INIT_OK)) {
                printk(KERN_ALERT "%s: MAC failed MR1 self-test.\n", priv->dev->name);
-                return 0;
+                return -EIO;
        }
        atmel_copy_to_host(priv->dev, (unsigned char *)iface,
@@ -3642,7 +3651,7 @@ static int atmel_wakeup_firmware(struct atmel_private *priv)
        iface->func_ctrl = le16_to_cpu(iface->func_ctrl);
        iface->mac_status = le16_to_cpu(iface->mac_status);
-        return 1;
+        return 0;
 }
 /* determine type of memory and MAC address */
@@ -3693,7 +3702,7 @@ static int probe_atmel_card(struct net_device *dev)
                /* Standard firmware in flash, boot it up and ask
                   for the Mac Address */
                priv->card_type = CARD_TYPE_SPI_FLASH;
-                if (atmel_wakeup_firmware(priv)) {
+                if (atmel_wakeup_firmware(priv) == 0) {
                        atmel_get_mib(priv, Mac_Address_Mib_Type, 0, dev->dev_addr, 6);
                        /* got address, now squash it again until the network
@@ -3835,6 +3844,7 @@ static int reset_atmel_card(struct net_device *dev)
        struct atmel_private *priv = netdev_priv(dev);
        u8 configuration;
        int old_state = priv->station_state;
+        int err = 0;
        /* data to add to the firmware names, in priority order
           this implemenents firmware versioning */
@@ -3868,11 +3878,12 @@ static int reset_atmel_card(struct net_device *dev)
                                               dev->name);
                                        strcpy(priv->firmware_id, "atmel_at76c502.bin");
                                }
-                                if (request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev) != 0) {
+                                err = request_firmware(&fw_entry, priv->firmware_id, priv->sys_dev);
+                                if (err != 0) {
                                        printk(KERN_ALERT
                                               "%s: firmware %s is missing, cannot continue.\n",
                                               dev->name, priv->firmware_id);
-                                        return 0;
+                                        return err;
                                }
                        } else {
                                int fw_index = 0;
@@ -3901,7 +3912,7 @@ static int reset_atmel_card(struct net_device *dev)
                                               "%s: firmware %s is missing, cannot start.\n",
                                               dev->name, priv->firmware_id);
                                        priv->firmware_id[0] = '\0';
-                                        return 0;
+                                        return -ENOENT;
                                }
                        }
@@ -3926,8 +3937,9 @@ static int reset_atmel_card(struct net_device *dev)
                        release_firmware(fw_entry);
        }
-        if (!atmel_wakeup_firmware(priv))
+        err = atmel_wakeup_firmware(priv);
-                return 0;
+        if (err != 0)
+                return err;
        /* Check the version and set the correct flag for wpa stuff,
           old and new firmware is incompatible.
@@ -3968,10 +3980,9 @@ static int reset_atmel_card(struct net_device *dev)
        if (!priv->radio_on_broken) {
                if (atmel_send_command_wait(priv, CMD_EnableRadio, NULL, 0) ==
                    CMD_STATUS_REJECTED_RADIO_OFF) {
-                        printk(KERN_INFO
+                        printk(KERN_INFO "%s: cannot turn the radio on.\n",
-                               "%s: cannot turn the radio on. (Hey radio, you're beautiful!)\n",
                               dev->name);
-                        return 0;
+                        return -EIO;
                }
        }
@@ -4006,7 +4017,7 @@ static int reset_atmel_card(struct net_device *dev)
                wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
        }
-        return 1;
+        return 0;
 }
 static void atmel_send_command(struct atmel_private *priv, int command,
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 3bf3a869361..7205a936ec7 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -33,7 +33,6 @@
 #include <linux/moduleparam.h>
 #include <linux/if_arp.h>
 #include <linux/etherdevice.h>
-#include <linux/version.h>
 #include <linux/firmware.h>
 #include <linux/wireless.h>
 #include <linux/workqueue.h>
@@ -4615,7 +4614,9 @@ static void b43_sprom_fixup(struct ssb_bus *bus)
        if (bus->bustype == SSB_BUSTYPE_PCI) {
                pdev = bus->host_pci;
                if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) ||
+                    IS_PDEV(pdev, BROADCOM, 0x4320,    DELL, 0x0003) ||
                    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) ||
+                    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0014) ||
                    IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013))
                        bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST;
        }
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 2541c81932f..1cb77db5c29 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -34,7 +34,6 @@
 #include <linux/moduleparam.h>
 #include <linux/if_arp.h>
 #include <linux/etherdevice.h>
-#include <linux/version.h>
 #include <linux/firmware.h>
 #include <linux/wireless.h>
 #include <linux/workqueue.h>
diff --git a/drivers/net/wireless/ipw2100.c b/drivers/net/wireless/ipw2100.c
index c6f886ec08a..19a401c4a0d 100644
--- a/drivers/net/wireless/ipw2100.c
+++ b/drivers/net/wireless/ipw2100.c
@@ -157,7 +157,6 @@ that only one external action is invoked at a time.
 #include <linux/stringify.h>
 #include <linux/tcp.h>
 #include <linux/types.h>
-#include <linux/version.h>
 #include <linux/time.h>
 #include <linux/firmware.h>
 #include <linux/acpi.h>
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index 36e8d2f6e7b..dcce3542d5a 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -31,7 +31,6 @@
 ******************************************************************************/
 #include "ipw2200.h"
-#include <linux/version.h>
 #ifndef KBUILD_EXTMOD
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-led.c b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
index d3336966b6b..705c65bed9f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
@@ -27,7 +27,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index b3931f6135a..3f51f363534 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -26,7 +26,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 22bb26985c2..23fed329896 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -26,7 +26,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
@@ -475,8 +474,8 @@ static void iwl4965_apm_stop(struct iwl_priv *priv)
        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
        udelay(10);
+        /* clear "init complete"  move adapter D0A* --> D0U state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
        spin_unlock_irqrestore(&priv->lock, flags);
 }
@@ -967,7 +966,7 @@ static int iwl4965_interpolate_chan(struct iwl_priv *priv, u32 channel,
        s = iwl4965_get_sub_band(priv, channel);
        if (s >= EEPROM_TX_POWER_BANDS) {
-                IWL_ERROR("Tx Power can not find channel %d ", channel);
+                IWL_ERROR("Tx Power can not find channel %d\n", channel);
                return -1;
        }
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index f3d139b663e..b08036a9d89 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -25,7 +25,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
@@ -146,7 +145,8 @@ static void iwl5000_apm_stop(struct iwl_priv *priv)
        udelay(10);
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+        /* clear "init complete"  move adapter D0A* --> D0U state */
+        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
        spin_unlock_irqrestore(&priv->lock, flags);
 }
@@ -578,14 +578,11 @@ static int iwl5000_load_section(struct iwl_priv *priv,
                FH_TFDIB_CTRL0_REG(FH_SRVC_CHNL),
                phy_addr & FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
-        /* FIME: write the MSB of the phy_addr in CTRL1
-         * iwl_write_direct32(priv,
-                IWL_FH_TFDIB_CTRL1_REG(IWL_FH_SRVC_CHNL),
-                ((phy_addr & MSB_MSK)
-                        << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_count);
-         */
        iwl_write_direct32(priv,
-                FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL), byte_cnt);
+                FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL),
+                (iwl_get_dma_hi_address(phy_addr)
+                        << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
        iwl_write_direct32(priv,
                FH_TCSR_CHNL_TX_BUF_STS_REG(FH_SRVC_CHNL),
                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 754fef5b592..90a2b6dee7c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -1153,7 +1153,8 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
            !sta->ht_info.ht_supported)
                return -1;
-        if (priv->current_ht_config.tx_mimo_ps_mode == IWL_MIMO_PS_STATIC)
+        if (((sta->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS) >> 2)
+                                                == IWL_MIMO_PS_STATIC)
                return -1;
        /* Need both Tx chains/antennas to support MIMO */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index ed09e48b1b6..e01f048a02d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -29,7 +29,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
@@ -182,14 +181,14 @@ static int iwl4965_check_rxon_cmd(struct iwl_rxon_cmd *rxon)
 }
 /**
- * iwl4965_full_rxon_required - check if full RXON (vs RXON_ASSOC) cmd is needed
+ * iwl_full_rxon_required - check if full RXON (vs RXON_ASSOC) cmd is needed
 * @priv: staging_rxon is compared to active_rxon
 *
 * If the RXON structure is changing enough to require a new tune,
 * or is clearing the RXON_FILTER_ASSOC_MSK, then return 1 to indicate that
 * a new tune (full RXON command, rather than RXON_ASSOC cmd) is required.
 */
-static int iwl4965_full_rxon_required(struct iwl_priv *priv)
+static int iwl_full_rxon_required(struct iwl_priv *priv)
 {
        /* These items are only settable from the full RXON command */
@@ -208,7 +207,6 @@ static int iwl4965_full_rxon_required(struct iwl_priv *priv)
             priv->active_rxon.ofdm_ht_single_stream_basic_rates) ||
            (priv->staging_rxon.ofdm_ht_dual_stream_basic_rates !=
             priv->active_rxon.ofdm_ht_dual_stream_basic_rates) ||
-            (priv->staging_rxon.rx_chain != priv->active_rxon.rx_chain) ||
            (priv->staging_rxon.assoc_id != priv->active_rxon.assoc_id))
                return 1;
@@ -264,7 +262,7 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv)
        /* If we don't need to send a full RXON, we can use
         * iwl4965_rxon_assoc_cmd which is used to reconfigure filter
         * and other flags for the current radio configuration. */
-        if (!iwl4965_full_rxon_required(priv)) {
+        if (!iwl_full_rxon_required(priv)) {
                ret = iwl_send_rxon_assoc(priv);
                if (ret) {
                        IWL_ERROR("Error setting RXON_ASSOC (%d)\n", ret);
@@ -588,8 +586,6 @@ static void iwl4965_ht_conf(struct iwl_priv *priv,
                iwl_conf->supported_chan_width = 0;
        }
-        iwl_conf->tx_mimo_ps_mode =
-                (u8)((ht_conf->cap & IEEE80211_HT_CAP_MIMO_PS) >> 2);
        memcpy(iwl_conf->supp_mcs_set, ht_conf->supp_mcs_set, 16);
        iwl_conf->control_channel = ht_bss_conf->primary_channel;
@@ -2191,7 +2187,10 @@ static void __iwl4965_down(struct iwl_priv *priv)
        udelay(5);
        /* FIXME: apm_ops.suspend(priv) */
-        priv->cfg->ops->lib->apm_ops.reset(priv);
+        if (exit_pending || test_bit(STATUS_IN_SUSPEND, &priv->status))
+                priv->cfg->ops->lib->apm_ops.stop(priv);
+        else
+                priv->cfg->ops->lib->apm_ops.reset(priv);
        priv->cfg->ops->lib->free_shared_mem(priv);
 exit:
@@ -2603,6 +2602,7 @@ static int iwl4965_mac_start(struct ieee80211_hw *hw)
 {
        struct iwl_priv *priv = hw->priv;
        int ret;
+        u16 pci_cmd;
        IWL_DEBUG_MAC80211("enter\n");
@@ -2613,6 +2613,13 @@ static int iwl4965_mac_start(struct ieee80211_hw *hw)
        pci_restore_state(priv->pci_dev);
        pci_enable_msi(priv->pci_dev);
+        /* enable interrupts if needed: hw bug w/a */
+        pci_read_config_word(priv->pci_dev, PCI_COMMAND, &pci_cmd);
+        if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
+                pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
+                pci_write_config_word(priv->pci_dev, PCI_COMMAND, pci_cmd);
+        }
        ret = request_irq(priv->pci_dev->irq, iwl4965_isr, IRQF_SHARED,
                          DRV_NAME, priv);
        if (ret) {
@@ -3581,7 +3588,7 @@ static int iwl4965_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *sk
        priv->assoc_id = 0;
        timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
-        priv->timestamp = le64_to_cpu(timestamp) +  (priv->beacon_int * 1000);
+        priv->timestamp = le64_to_cpu(timestamp);
        IWL_DEBUG_MAC80211("leave\n");
        spin_unlock_irqrestore(&priv->lock, flags);
@@ -4365,15 +4372,18 @@ static void __devexit iwl4965_pci_remove(struct pci_dev *pdev)
        iwl_dbgfs_unregister(priv);
        sysfs_remove_group(&pdev->dev.kobj, &iwl4965_attribute_group);
+        /* ieee80211_unregister_hw call wil cause iwl4965_mac_stop to
+         * to be called and iwl4965_down since we are removing the device
+         * we need to set STATUS_EXIT_PENDING bit.
+         */
+        set_bit(STATUS_EXIT_PENDING, &priv->status);
        if (priv->mac80211_registered) {
                ieee80211_unregister_hw(priv->hw);
                priv->mac80211_registered = 0;
+        } else {
+                iwl4965_down(priv);
        }
-        set_bit(STATUS_EXIT_PENDING, &priv->status);
-        iwl4965_down(priv);
        /* make sure we flush any pending irq or
         * tasklet for the driver
         */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 9bd61809129..80f2f84defa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -28,7 +28,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <net/mac80211.h>
 struct iwl_priv; /* FIXME: remove */
@@ -593,12 +592,11 @@ static void iwlcore_free_geos(struct iwl_priv *priv)
        clear_bit(STATUS_GEO_CONFIGURED, &priv->status);
 }
-static u8 is_single_rx_stream(struct iwl_priv *priv)
+static bool is_single_rx_stream(struct iwl_priv *priv)
 {
        return !priv->current_ht_config.is_ht ||
               ((priv->current_ht_config.supp_mcs_set[1] == 0) &&
-                (priv->current_ht_config.supp_mcs_set[2] == 0)) ||
+                (priv->current_ht_config.supp_mcs_set[2] == 0));
-               priv->ps_mode == IWL_MIMO_PS_STATIC;
 }
 static u8 iwl_is_channel_extension(struct iwl_priv *priv,
@@ -705,33 +703,39 @@ EXPORT_SYMBOL(iwl_set_rxon_ht);
 * MIMO (dual stream) requires at least 2, but works better with 3.
 * This does not determine *which* chains to use, just how many.
 */
-static int iwlcore_get_rx_chain_counter(struct iwl_priv *priv,
+static int iwl_get_active_rx_chain_count(struct iwl_priv *priv)
-                                        u8 *idle_state, u8 *rx_state)
 {
-        u8 is_single = is_single_rx_stream(priv);
+        bool is_single = is_single_rx_stream(priv);
-        u8 is_cam = test_bit(STATUS_POWER_PMI, &priv->status) ? 0 : 1;
+        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
        /* # of Rx chains to use when expecting MIMO. */
        if (is_single || (!is_cam && (priv->ps_mode == IWL_MIMO_PS_STATIC)))
-                *rx_state = 2;
+                return 2;
        else
-                *rx_state = 3;
+                return 3;
+}
+static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
+{
+        int idle_cnt;
+        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
        /* # Rx chains when idling and maybe trying to save power */
        switch (priv->ps_mode) {
        case IWL_MIMO_PS_STATIC:
        case IWL_MIMO_PS_DYNAMIC:
-                *idle_state = (is_cam) ? 2 : 1;
+                idle_cnt = (is_cam) ? 2 : 1;
                break;
        case IWL_MIMO_PS_NONE:
-                *idle_state = (is_cam) ? *rx_state : 1;
+                idle_cnt = (is_cam) ? active_cnt : 1;
                break;
+        case IWL_MIMO_PS_INVALID:
        default:
-                *idle_state = 1;
+                IWL_ERROR("invalide mimo ps mode %d\n", priv->ps_mode);
+                WARN_ON(1);
+                idle_cnt = -1;
                break;
        }
+        return idle_cnt;
-        return 0;
 }
 /**
@@ -742,34 +746,44 @@ static int iwlcore_get_rx_chain_counter(struct iwl_priv *priv,
 */
 void iwl_set_rxon_chain(struct iwl_priv *priv)
 {
-        u8 is_single = is_single_rx_stream(priv);
+        bool is_single = is_single_rx_stream(priv);
-        u8 idle_state, rx_state;
+        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
+        u8 idle_rx_cnt, active_rx_cnt;
-        priv->staging_rxon.rx_chain = 0;
+        u16 rx_chain;
-        rx_state = idle_state = 3;
        /* Tell uCode which antennas are actually connected.
         * Before first association, we assume all antennas are connected.
         * Just after first association, iwl_chain_noise_calibration()
         *    checks which antennas actually *are* connected. */
-        priv->staging_rxon.rx_chain |=
+        rx_chain = priv->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
-                    cpu_to_le16(priv->hw_params.valid_rx_ant <<
-                                                 RXON_RX_CHAIN_VALID_POS);
        /* How many receivers should we use? */
-        iwlcore_get_rx_chain_counter(priv, &idle_state, &rx_state);
+        active_rx_cnt = iwl_get_active_rx_chain_count(priv);
-        priv->staging_rxon.rx_chain |=
+        idle_rx_cnt = iwl_get_idle_rx_chain_count(priv, active_rx_cnt);
-                cpu_to_le16(rx_state << RXON_RX_CHAIN_MIMO_CNT_POS);
-        priv->staging_rxon.rx_chain |=
+        /* correct rx chain count accoridng hw settings */
-                cpu_to_le16(idle_state << RXON_RX_CHAIN_CNT_POS);
+        if (priv->hw_params.rx_chains_num < active_rx_cnt)
+                active_rx_cnt = priv->hw_params.rx_chains_num;
-        if (!is_single && (rx_state >= 2) &&
-            !test_bit(STATUS_POWER_PMI, &priv->status))
+        if (priv->hw_params.rx_chains_num < idle_rx_cnt)
+                idle_rx_cnt = priv->hw_params.rx_chains_num;
+        rx_chain |= active_rx_cnt << RXON_RX_CHAIN_MIMO_CNT_POS;
+        rx_chain |= idle_rx_cnt  << RXON_RX_CHAIN_CNT_POS;
+        priv->staging_rxon.rx_chain = cpu_to_le16(rx_chain);
+        if (!is_single && (active_rx_cnt >= 2) && is_cam)
                priv->staging_rxon.rx_chain |= RXON_RX_CHAIN_MIMO_FORCE_MSK;
        else
                priv->staging_rxon.rx_chain &= ~RXON_RX_CHAIN_MIMO_FORCE_MSK;
-        IWL_DEBUG_ASSOC("rx chain %X\n", priv->staging_rxon.rx_chain);
+        IWL_DEBUG_ASSOC("rx_chain=0x%Xi active=%d idle=%d\n",
+                        priv->staging_rxon.rx_chain,
+                        active_rx_cnt, idle_rx_cnt);
+        WARN_ON(active_rx_cnt == 0 || idle_rx_cnt == 0 ||
+                active_rx_cnt < idle_rx_cnt);
 }
 EXPORT_SYMBOL(iwl_set_rxon_chain);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index c19db438306..cdfb343c7ec 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -412,7 +412,6 @@ struct iwl_ht_info {
        /* self configuration data */
        u8 is_ht;
        u8 supported_chan_width;
-        u16 tx_mimo_ps_mode;
        u8 is_green_field;
        u8 sgf;                 /* HT_SHORT_GI_* short guard interval */
        u8 max_amsdu_size;
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index bce53830b30..37155755efc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -63,7 +63,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/init.h>
 #include <net/mac80211.h>
@@ -146,7 +145,7 @@ int iwlcore_eeprom_verify_signature(struct iwl_priv *priv)
 {
        u32 gp = iwl_read32(priv, CSR_EEPROM_GP);
        if ((gp & CSR_EEPROM_GP_VALID_MSK) == CSR_EEPROM_GP_BAD_SIGNATURE) {
-                IWL_ERROR("EEPROM not found, EEPROM_GP=0x%08x", gp);
+                IWL_ERROR("EEPROM not found, EEPROM_GP=0x%08x\n", gp);
                return -ENOENT;
        }
        return 0;
@@ -227,7 +226,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
        ret = priv->cfg->ops->lib->eeprom_ops.verify_signature(priv);
        if (ret < 0) {
-                IWL_ERROR("EEPROM not found, EEPROM_GP=0x%08x", gp);
+                IWL_ERROR("EEPROM not found, EEPROM_GP=0x%08x\n", gp);
                ret = -ENOENT;
                goto err;
        }
@@ -254,7 +253,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
                }
                if (!(r & CSR_EEPROM_REG_READ_VALID_MSK)) {
-                        IWL_ERROR("Time out reading EEPROM[%d]", addr);
+                        IWL_ERROR("Time out reading EEPROM[%d]\n", addr);
                        ret = -ETIMEDOUT;
                        goto done;
                }
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index 944642450d3..cd11c0ca299 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -287,6 +287,7 @@
 #define FH_RSSR_CHNL0_RX_STATUS_CHNL_IDLE       (0x01000000)
+#define FH_MEM_TFDIB_REG1_ADDR_BITSHIFT 28
 /**
 * Transmit DMA Channel Control/Status Registers (TCSR)
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 6512834bb91..2eb03eea190 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -28,7 +28,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <net/mac80211.h>
 #include "iwl-dev.h" /* FIXME: remove */
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/iwl-led.c
index cb11c4a4d69..4eee1b163cd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-led.c
@@ -27,7 +27,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 028e3053c0c..a099c9e30e5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -29,7 +29,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/init.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/iwlwifi/iwl-rfkill.c b/drivers/net/wireless/iwlwifi/iwl-rfkill.c
index e5e5846e9f2..5d642298f04 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rfkill.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rfkill.c
@@ -27,7 +27,6 @@
 *****************************************************************************/
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/init.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index f3f6ea49fdd..e81bfc42a7c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -1173,7 +1173,10 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
        rx_status.antenna = 0;
        rx_status.flag = 0;
-        rx_status.flag |= RX_FLAG_TSFT;
+        /* TSF isn't reliable. In order to allow smooth user experience,
+         * this W/A doesn't propagate it to the mac80211 */
+        /*rx_status.flag |= RX_FLAG_TSFT;*/
        if ((unlikely(rx_start->cfg_phy_cnt > 20))) {
                IWL_DEBUG_DROP("dsp size out of range [0,20]: %d/n",
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 9bb6adb28b7..6c8ac3a87d5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -421,7 +421,7 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
                else
                        scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
-                if ((scan_ch->type & SCAN_CHANNEL_TYPE_ACTIVE) && n_probes)
+                if (n_probes)
                        scan_ch->type |= IWL_SCAN_PROBE_MASK(n_probes);
                scan_ch->active_dwell = cpu_to_le16(active_dwell);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 60a6e010603..6283a3a707f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -207,7 +207,7 @@ static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
        case WLAN_HT_CAP_MIMO_PS_DISABLED:
                break;
        default:
-                IWL_WARNING("Invalid MIMO PS mode %d", mimo_ps_mode);
+                IWL_WARNING("Invalid MIMO PS mode %d\n", mimo_ps_mode);
                break;
        }
@@ -969,7 +969,7 @@ int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
                return priv->hw_params.bcast_sta_id;
        default:
-                IWL_WARNING("Unknown mode of operation: %d", priv->iw_mode);
+                IWL_WARNING("Unknown mode of operation: %d\n", priv->iw_mode);
                return priv->hw_params.bcast_sta_id;
        }
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 4108c7c8f00..78b1a7a4ca4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -402,12 +402,11 @@ static int iwl_hw_tx_queue_init(struct iwl_priv *priv,
 /**
 * iwl_tx_queue_init - Allocate and initialize one tx/cmd queue
 */
-static int iwl_tx_queue_init(struct iwl_priv *priv,
+static int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
-                             struct iwl_tx_queue *txq,
                             int slots_num, u32 txq_id)
 {
        int i, len;
-        int rc = 0;
+        int ret;
        /*
         * Alloc buffer array for commands (Tx or other types of commands).
@@ -426,19 +425,16 @@ static int iwl_tx_queue_init(struct iwl_priv *priv,
                                continue;
                }
-                txq->cmd[i] = kmalloc(len, GFP_KERNEL | GFP_DMA);
+                txq->cmd[i] = kmalloc(len, GFP_KERNEL);
                if (!txq->cmd[i])
-                        return -ENOMEM;
+                        goto err;
        }
        /* Alloc driver data array and TFD circular buffer */
-        rc = iwl_tx_queue_alloc(priv, txq, txq_id);
+        ret = iwl_tx_queue_alloc(priv, txq, txq_id);
-        if (rc) {
+        if (ret)
-                for (i = 0; i < slots_num; i++)
+                goto err;
-                        kfree(txq->cmd[i]);
-                return -ENOMEM;
-        }
        txq->need_update = 0;
        /* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
@@ -452,6 +448,17 @@ static int iwl_tx_queue_init(struct iwl_priv *priv,
        iwl_hw_tx_queue_init(priv, txq);
        return 0;
+err:
+        for (i = 0; i < slots_num; i++) {
+                kfree(txq->cmd[i]);
+                txq->cmd[i] = NULL;
+        }
+        if (txq_id == IWL_CMD_QUEUE_NUM) {
+                kfree(txq->cmd[slots_num]);
+                txq->cmd[slots_num] = NULL;
+        }
+        return -ENOMEM;
 }
 /**
 * iwl_hw_txq_ctx_free - Free TXQ Context
@@ -493,7 +500,7 @@ int iwl_txq_ctx_reset(struct iwl_priv *priv)
        /* Alloc keep-warm buffer */
        ret = iwl_kw_alloc(priv);
        if (ret) {
-                IWL_ERROR("Keep Warm allocation failed");
+                IWL_ERROR("Keep Warm allocation failed\n");
                goto error_kw;
        }
        spin_lock_irqsave(&priv->lock, flags);
@@ -1463,7 +1470,7 @@ void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
        u16 ba_resp_scd_ssn = le16_to_cpu(ba_resp->scd_ssn);
        if (scd_flow >= priv->hw_params.max_txq_num) {
-                IWL_ERROR("BUG_ON scd_flow is bigger than number of queues");
+                IWL_ERROR("BUG_ON scd_flow is bigger than number of queues\n");
                return;
        }
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 444847ab1b5..b775d5bab66 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -29,7 +29,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
@@ -1558,7 +1557,7 @@ int iwl3945_eeprom_init(struct iwl3945_priv *priv)
        BUILD_BUG_ON(sizeof(priv->eeprom) != IWL_EEPROM_IMAGE_SIZE);
        if ((gp & CSR_EEPROM_GP_VALID_MSK) == CSR_EEPROM_GP_BAD_SIGNATURE) {
-                IWL_ERROR("EEPROM not found, EEPROM_GP=0x%08x", gp);
+                IWL_ERROR("EEPROM not found, EEPROM_GP=0x%08x\n", gp);
                return -ENOENT;
        }
@@ -1583,7 +1582,7 @@ int iwl3945_eeprom_init(struct iwl3945_priv *priv)
                }
                if (!(r & CSR_EEPROM_REG_READ_VALID_MSK)) {
-                        IWL_ERROR("Time out reading EEPROM[%d]", addr);
+                        IWL_ERROR("Time out reading EEPROM[%d]\n", addr);
                        return -ETIMEDOUT;
                }
                e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16));
@@ -2507,7 +2506,7 @@ static int iwl3945_get_sta_id(struct iwl3945_priv *priv, struct ieee80211_hdr *h
                return priv->hw_setting.bcast_sta_id;
        default:
-                IWL_WARNING("Unknown mode of operation: %d", priv->iw_mode);
+                IWL_WARNING("Unknown mode of operation: %d\n", priv->iw_mode);
                return priv->hw_setting.bcast_sta_id;
        }
 }
diff --git a/drivers/net/wireless/libertas/if_cs.c b/drivers/net/wireless/libertas/if_cs.c
index 04d7a251e3f..8941919001b 100644
--- a/drivers/net/wireless/libertas/if_cs.c
+++ b/drivers/net/wireless/libertas/if_cs.c
@@ -595,7 +595,7 @@ static int if_cs_prog_helper(struct if_cs_card *card)
                if (ret < 0) {
                        lbs_pr_err("can't download helper at 0x%x, ret %d\n",
                                sent, ret);
-                        goto done;
+                        goto err_release;
                }
                if (count == 0)
@@ -604,9 +604,8 @@ static int if_cs_prog_helper(struct if_cs_card *card)
                sent += count;
        }
+err_release:
        release_firmware(fw);
-        ret = 0;
 done:
        lbs_deb_leave_args(LBS_DEB_CS, "ret %d", ret);
        return ret;
@@ -676,14 +675,8 @@ static int if_cs_prog_real(struct if_cs_card *card)
        }
        ret = if_cs_poll_while_fw_download(card, IF_CS_SCRATCH, 0x5a);
-        if (ret < 0) {
+        if (ret < 0)
                lbs_pr_err("firmware download failed\n");
-                goto err_release;
-        }
-        ret = 0;
-        goto done;
 err_release:
        release_firmware(fw);
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index 1ebcafe7ca5..36c004e1560 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -1970,6 +1970,9 @@ __orinoco_set_multicast_list(struct net_device *dev)
                        priv->promiscuous = promisc;
        }
+        /* If we're not in promiscuous mode, then we need to set the
+         * group address if either we want to multicast, or if we were
+         * multicasting and want to stop */
        if (! promisc && (mc_count || priv->mc_count) ) {
                struct dev_mc_list *p = dev->mc_list;
                struct hermes_multicast mclist;
@@ -1989,9 +1992,10 @@ __orinoco_set_multicast_list(struct net_device *dev)
                        printk(KERN_WARNING "%s: Multicast list is "
                               "longer than mc_count\n", dev->name);
-                err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFGROUPADDRESSES,
+                err = hermes_write_ltv(hw, USER_BAP,
-                                       HERMES_BYTES_TO_RECLEN(priv->mc_count * ETH_ALEN),
+                                   HERMES_RID_CNFGROUPADDRESSES,
-                                       &mclist);
+                                   HERMES_BYTES_TO_RECLEN(mc_count * ETH_ALEN),
+                                   &mclist);
                if (err)
                        printk(KERN_ERR "%s: Error %d setting multicast list.\n",
                               dev->name, err);
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 83cd85e1f84..29be3dc8ee0 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -413,12 +413,12 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
                        last_addr = range->end_addr;
                        __skb_unlink(entry, &priv->tx_queue);
                        memset(&info->status, 0, sizeof(info->status));
-                        priv->tx_stats[skb_get_queue_mapping(skb)].len--;
                        entry_hdr = (struct p54_control_hdr *) entry->data;
                        entry_data = (struct p54_tx_control_allocdata *) entry_hdr->data;
                        if ((entry_hdr->magic1 & cpu_to_le16(0x4000)) != 0)
                                pad = entry_data->align[0];
+                        priv->tx_stats[entry_data->hw_queue - 4].len--;
                        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
                                if (!(payload->status & 0x01))
                                        info->flags |= IEEE80211_TX_STAT_ACK;
@@ -557,6 +557,7 @@ static int p54_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
        struct p54_tx_control_allocdata *txhdr;
        size_t padding, len;
        u8 rate;
+        u8 cts_rate = 0x20;
        current_queue = &priv->tx_stats[skb_get_queue_mapping(skb)];
        if (unlikely(current_queue->len > current_queue->limit))
@@ -581,28 +582,28 @@ static int p54_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
        hdr->type = (info->flags & IEEE80211_TX_CTL_NO_ACK) ? 0 : cpu_to_le16(1);
        hdr->retry1 = hdr->retry2 = info->control.retry_limit;
-        memset(txhdr->wep_key, 0x0, 16);
-        txhdr->padding = 0;
-        txhdr->padding2 = 0;
        /* TODO: add support for alternate retry TX rates */
        rate = ieee80211_get_tx_rate(dev, info)->hw_value;
-        if (info->flags & IEEE80211_TX_CTL_SHORT_PREAMBLE)
+        if (info->flags & IEEE80211_TX_CTL_SHORT_PREAMBLE) {
                rate |= 0x10;
-        if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
+                cts_rate |= 0x10;
+        }
+        if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) {
                rate |= 0x40;
-        else if (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT)
+                cts_rate |= ieee80211_get_rts_cts_rate(dev, info)->hw_value;
+        } else if (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT) {
                rate |= 0x20;
+                cts_rate |= ieee80211_get_rts_cts_rate(dev, info)->hw_value;
+        }
        memset(txhdr->rateset, rate, 8);
-        txhdr->wep_key_present = 0;
+        txhdr->key_type = 0;
-        txhdr->wep_key_len = 0;
+        txhdr->key_len = 0;
-        txhdr->frame_type = cpu_to_le32(skb_get_queue_mapping(skb) + 4);
+        txhdr->hw_queue = skb_get_queue_mapping(skb) + 4;
-        txhdr->magic4 = 0;
+        txhdr->tx_antenna = (info->antenna_sel_tx == 0) ?
-        txhdr->antenna = (info->antenna_sel_tx == 0) ?
                2 : info->antenna_sel_tx - 1;
        txhdr->output_power = 0x7f; // HW Maximum
-        txhdr->magic5 = (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
+        txhdr->cts_rate = (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
-                0 : ((rate > 0x3) ? cpu_to_le32(0x33) : cpu_to_le32(0x23));
+                          0 : cts_rate;
        if (padding)
                txhdr->align[0] = padding;
@@ -836,10 +837,21 @@ static int p54_start(struct ieee80211_hw *dev)
        struct p54_common *priv = dev->priv;
        int err;
+        if (!priv->cached_vdcf) {
+                priv->cached_vdcf = kzalloc(sizeof(struct p54_tx_control_vdcf)+
+                        priv->tx_hdr_len + sizeof(struct p54_control_hdr),
+                        GFP_KERNEL);
+                if (!priv->cached_vdcf)
+                        return -ENOMEM;
+        }
        err = priv->open(dev);
        if (!err)
                priv->mode = IEEE80211_IF_TYPE_MNTR;
+        p54_init_vdcf(dev);
        return err;
 }
@@ -1019,15 +1031,6 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
        dev->extra_tx_headroom = sizeof(struct p54_control_hdr) + 4 +
                                 sizeof(struct p54_tx_control_allocdata);
-        priv->cached_vdcf = kzalloc(sizeof(struct p54_tx_control_vdcf) +
-              priv->tx_hdr_len + sizeof(struct p54_control_hdr), GFP_KERNEL);
-        if (!priv->cached_vdcf) {
-                ieee80211_free_hw(dev);
-                return NULL;
-        }
-        p54_init_vdcf(dev);
        mutex_init(&priv->conf_mutex);
        return dev;
diff --git a/drivers/net/wireless/p54/p54common.h b/drivers/net/wireless/p54/p54common.h
index 2245fcce92d..8db6c0e8e54 100644
--- a/drivers/net/wireless/p54/p54common.h
+++ b/drivers/net/wireless/p54/p54common.h
@@ -183,16 +183,16 @@ struct p54_frame_sent_hdr {
 struct p54_tx_control_allocdata {
        u8 rateset[8];
-        u16 padding;
+        u8 unalloc0[2];
-        u8 wep_key_present;
+        u8 key_type;
-        u8 wep_key_len;
+        u8 key_len;
-        u8 wep_key[16];
+        u8 key[16];
-        __le32 frame_type;
+        u8 hw_queue;
-        u32 padding2;
+        u8 unalloc1[9];
-        __le16 magic4;
+        u8 tx_antenna;
-        u8 antenna;
        u8 output_power;
-        __le32 magic5;
+        u8 cts_rate;
+        u8 unalloc2[3];
        u8 align[0];
 } __attribute__ ((packed));
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 815c095ef79..cbaca23a945 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -109,7 +109,17 @@ static void p54u_rx_cb(struct urb *urb)
                urb->context = skb;
                skb_queue_tail(&priv->rx_queue, skb);
        } else {
+                if (!priv->hw_type)
+                        skb_push(skb, sizeof(struct net2280_tx_hdr));
+                skb_reset_tail_pointer(skb);
                skb_trim(skb, 0);
+                if (urb->transfer_buffer != skb_tail_pointer(skb)) {
+                        /* this should not happen */
+                        WARN_ON(1);
+                        urb->transfer_buffer = skb_tail_pointer(skb);
+                }
                skb_queue_tail(&priv->rx_queue, skb);
        }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index a4a8c57004d..ff78e52ce43 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -173,10 +173,10 @@ struct rxdone_entry_desc {
 *      frame transmission failed due to excessive retries.
 */
 enum txdone_entry_desc_flags {
-        TXDONE_UNKNOWN = 1 << 0,
+        TXDONE_UNKNOWN,
-        TXDONE_SUCCESS = 1 << 1,
+        TXDONE_SUCCESS,
-        TXDONE_FAILURE = 1 << 2,
+        TXDONE_FAILURE,
-        TXDONE_EXCESSIVE_RETRY = 1 << 3,
+        TXDONE_EXCESSIVE_RETRY,
 };
 /**
diff --git a/drivers/net/wireless/rt2x00/rt2x00reg.h b/drivers/net/wireless/rt2x00/rt2x00reg.h
index 7e88ce5651b..2ea7866abd5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00reg.h
+++ b/drivers/net/wireless/rt2x00/rt2x00reg.h
@@ -136,7 +136,7 @@ struct rt2x00_field32 {
 */
 #define is_power_of_two(x)      ( !((x) & ((x)-1)) )
 #define low_bit_mask(x)         ( ((x)-1) & ~(x) )
-#define is_valid_mask(x)        is_power_of_two(1 + (x) + low_bit_mask(x))
+#define is_valid_mask(x)        is_power_of_two(1LU + (x) + low_bit_mask(x))
 /*
 * Macro's to find first set bit in a variable.
@@ -173,8 +173,7 @@ struct rt2x00_field32 {
 * does not exceed the given typelimit.
 */
 #define FIELD_CHECK(__mask, __type)                     \
-        BUILD_BUG_ON(!__builtin_constant_p(__mask) ||   \
+        BUILD_BUG_ON(!(__mask) ||                       \
-                     !(__mask) ||                       \
                     !is_valid_mask(__mask) ||          \
                     (__mask) != (__type)(__mask))      \
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 8d76bb2e031..2050227ea53 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -181,6 +181,7 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
         * (Only indirectly by looking at the failed TX counters
         * in the register).
         */
+        txdesc.flags = 0;
        if (!urb->status)
                __set_bit(TXDONE_UNKNOWN, &txdesc.flags);
        else
diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c
index 57376fb993e..ca5deb6244e 100644
--- a/drivers/net/wireless/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl8187_dev.c
@@ -40,6 +40,7 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
        /* Netgear */
        {USB_DEVICE(0x0846, 0x6100), .driver_info = DEVICE_RTL8187},
        {USB_DEVICE(0x0846, 0x6a00), .driver_info = DEVICE_RTL8187},
+        {USB_DEVICE(0x0846, 0x4260), .driver_info = DEVICE_RTL8187B},
        /* HP */
        {USB_DEVICE(0x03f0, 0xca02), .driver_info = DEVICE_RTL8187},
        /* Sitecom */